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The relative entropy of two n-party quantum states is an important quantity exhibiting, 
for example, the extent to which the two states are different. The relative entropy of the 
states formed by reducing two n-party to a smaller number m of parties is always less than 
or equal to the relative entropy of the two original n-party states. This is the monotonicity 
of relative entropy. 

Using techniques from convex geometry we prove that monotonicity under restrictions is 
the only general inequality satisfied by relative entropies. In doing so we make a connection 
OA ■ to secret sharing schemes with general access structures. 

J> \ A suprising outcome is that the structure of allowed relative entropy values of subsets 

of multiparty states is much simpler than the structure of allowed entropy values. And 
^ | \ the structure of allowed relative entropy values (unlike that of entropies) is the same for 

classical probability distributions and quantum states. 
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I. ENTROPY AND RELATIVE ENTROPY 



Entropy inequalities play a central role in information theory 1 5], classical or quantum. This 
is so because practically all capacity theorems are formulated in terms of entropy, and the same, 
albeit to a lesser degree, holds for many monotones, of, for example, entanglement: e.g., the 
entanglement of formation |2] or squashed entanglement |4]. It may thus come as a surprise that until 
recently [11] essentially the only inequality known for the von Neumann entropies in a composite 
system is strong subadditivity 

Er: s( P AB ) + s( P BC ) > s{ P ABC ) + s( P B ), a) 

proved by Lieb and Ruskai |8]. We use the notation p ABC for the density operator representing 
^ ■ the state of the system ABC, with the notation p BC = Tva p ABC etc. for the reduced states. 

The relative entropy of two states p, a (density operators of trace 1) is defined as 



D(p\\a) 



Tr p(log p — log a) if supp p C supp a, 
+oo otherwise, 



where supp p is the supporting subspace of the density operator p. Note that in this paper, log 
always denotes the logarithm to base 2. Like von Neumann entropy, the relative entropy is used 
extensively in quantum information and entanglement theory to obtain capacity-like quantities 
and monotones. The most prominent example may be the relative entropy of entanglement 1 19, 20]. 
Many other applications of the relative entropy are illustrated in the review 

In this paper we study the universal relations between the relative entropies in a composite 
system and for general pairs of states. For the most part we shall restrict ourselves to finite di- 
mensional spaces. 
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What are the known inequalities? First of all, the relative entropy is always nonnegative, and 
indeed iff p = a (see the recent survey by Petz [l3]). The most important, and indeed only 
known inequality, for the relative entropy is the monotonicity , 



D(p AB \\a AB )>D(p A \\a A ) (2) 

for a bipartite system AB. This relation can be derived from strong subbadditivity, eq. 0, as was 
shown by Lindblad ]9] in the finite dimensional case; Uhlmann |17] later showed it in generality 
To illustrate the connection, strong subadditivity can be easily derived from eq. (2). Note that we 
can identify the following relative entropy quantity with quantum mutual information |3]: 

D(p AB \\p A ® p B ) = Tr (p AB log/ B ) - Tr (p AB log(/ ® p B )) 

= _S(p AB ) - Tr (p AB log p A ) - Tr (p AB log p B ) 
= S(p AB ) + S(p A ) + S(p B ) 
= I(A:B). 

Hence we can recover strong subadditivity from the monotonicity relation 

D(p ABC \\p AB ®p°) >D(p BC \\p B ®p c ), 

as follows: 

< D(p ABC \\p AB p c ) - D{p BC \\p B p c ) 
= I(AB : C) - I(B : C) 

= S(p AB ) + S{p c ) - S(p ABC ) - S(p B ) - S(p c ) + S(p BC ) 
= S(p AB ) + S{p BC ) - S{p ABC ) - S(p B ). 

Before returning to relative entropy we make a few further observations about entropy. For an n- 
party system, there are 2 n — 1 non-trivial reduced states, with their entropies, so we can associate 
with each state a vector of 2 n — 1 real coordinates. Pippenger [14], following the programme of 
Yeung and Zhang in the classical case l2lll . showed that, after going to the topological closure, 
the set of all entropy vectors is a convex cone. Hence it must be describable by linear (entropy) 
inequalities, like strong subadditivity, and one can ask if the entropy cone coincides with the 
cone defined by the "known" inequalities (strong subadditivity in the quantum case, additionally 
positivity of conditional entropy classically). This is indeed the case for n < 3: the classical result 
is due to Yeung and Zhang |21], the quantum case by Pippenger 1 14]. Yeung and Zhang ] 22] have 
however found a new, "non-Shannon type" inequality for n = 4 classical parties, and Linden and 
Winter |11] found a new so-called constrained inequality for n = 4 quantum parties, providing 
evidence that to describe the entropy cones of four and more parties one needs new inequalities, 
too. 

In |ll|] Linden and Winter describe how the putative vector of entropies, 

[S A , S B , ... , Sabcd] = A[3, 3, 2, 2, 4, 3, 3, 3, 3, 4, 4, 4, 3, 3, 2], (3) 

for A > 0, satisfies strong subadditivity for all subsets of parties ABCD, but is nonetheless not 
achievable by any quantum state p [i.e. there is no quantum state p such that Sa = Sa(pa), Sb = 
Sb(pb) etc. achieving the values in eq. 0]. Here we ask (and answer in the affirmative) the 
question of whether any vector 



[Da, D b , • • • , Dabcd] 
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in which the numbers Da, ■ ■ ■ , Dabcd satisfy the constraints of monotonicity for all subgroups 
may be realised as the relative entropy of pairs of states [i.e. for any such vector we show that 
there are states p and a such that Da = D(pa\\(Ta) etc.] 

In this paper we prove the result that for relative entropy monotonicity is necessary and suf- 
ficient to describe the complete set of realisable relative entropy vectors. This is a surprising 
discovery as relative entropy is a seemingly more complex functional than entropy. However 
strong subadditivity is sufficient to define all possible relative entropy vectors (as monotonicity 
is derived from it) whereas it cannot encapsulate normal von Neumann entropy. Our approach 
is as follows: we show first, by adapting the Yeung-Pippenger techniques, that the topological 
closure of the set of all relative entropy vectors is a convex cone (section Then we study the 
extremal rays of the Lindblad-Uhlmann cone defined by monotonicity, in section they cor- 
respond one-to-one to so-called up-sets in 2^ n \ It remains to prove that every one of the rays is 
indeed populated by relative entropy vectors, which we do in section|lV| It turns out that the con- 
struction to show this depends heavily on secret sharing schemes, which we explain in section Hvl 
to make the paper self-contained, followed by an instructive example in section|Vj after which we 
conclude. 

II. THE CONE OF RELATIVE ENTROPY VECTORS 

Define the set A* c M>™ _1 of vectors v = (v s )^ Sc ^ , with [n] = {1, 2, . . . , n}: v G A* iff there 

exist quantum states of ra-parties p, a such that D(p s \\a s ) = v$ for every non empty subset S. 
Observe that there are 2 n — 1 nonempty subsets S, which label the coordinates of M 2 ™ -1 in some 
fixed way. 

Lemma 1 The topological closure A* of A* is a convex cone. To be precise, it is enough to show that 

1. (Additivity) for v, w G A*, v + w G A*; 

2. (Approximate diluability) for all 5 > there exists e > such that for all v G A* and < A < e 
there is w G A* with ||Av — w|| < 5. 

(We use the sup norm in the proof below, but since all norms infinite dimensions are equivalent, the exact 
choice of the norm is irrelevant.) 

Proof Consider the following states p,p' ,a and a' where the prime indicates that the correspond- 
ing state lives on a system different from the unprimed states. Let us define v and v' as the relative 
entropy vectors generated from taking entropy values of D(p s \\a s ) and D(p s \\a s ) respectively. 
Consider states p = p®p' and a = a a'. To prove the first part of the Lemma, we show v = v' + v 
for the relative entropy vector v of p; in detail, for every S C [n], 

D{p s \\a s ) = D{p s ® p' s \\a s ® a' s ) = D(p s \\a s ) + D(p' s \\a' s ). 

Then, 

D(p s \\a s ) = - S(p s ) - Tr(p 5 logo 5 ) 

= - S(p s ) - S(p' s ) - Tr (p s ® p' s log {a s ® a' s )) . 

We use the fact that log(<r (8) a') = (log a) <g> 1 + 1 <g> (log a'). Therefore, 

D(p s \\a s ) = - S(p s ) - S(p' s ) - Tr(p 5 logcj 5 ) - Tr(// 5 log a' s ) 
=D(p s \\a s ) + D(p' s \\a ,s ). 
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Therefore we can always construct a state that will give a vector in A* and is the sum of v and v'. 

To prove the second part, choose e such that e < 1/2 and H2(e) < S where H2(e) is the binary 
entropy of e, 

fla(e) = -eloge-(l-e)log(l-e). 

Note that we can always choose a value of e which satisfies these conditions for any 5. Let v be 
the relative entropy vector created by states p, a. Consider the following states, p = Xp + (1 — X)a 
and a = a with the entropy vector w created by states p, a. Consider the following quantity that 
leads to the entropy vector w: 

D{f\\a s ) =D(Xp s + (1 - X)a s \\a s ) 

= - S(Xp s + (1 - X)a s ) - Ti[(Xp S + (1 - X)a s ) log a 5 ] 

= - S(Xp s + (1 - X)a s ) - ATr(/log<7 5 ) - (1 - A) Tr(cr 5 log a s ). (4) 

We now make use of the following inequality, see for example 112]. 

^2,PiS{pi) <s( ^PiPij < H(pi) + ^2piS(pi), 

i ^ i ' i 

which here specialises to 

XS(p s ) + (1 - X)S(a s ) < S(Xp s + (1 - X)a s ) < H 2 (X) + XS(p s ) + (1 - X)S(a s ). 

Hence we can define a quantity a such that < a < #2 (A) < ^(e) < 5 

S(Xp s + (1 - X)a s ) = XS(p s ) + (1 - X)S(a s ) + a. 

Therefore, eq. (|4j reads, 

D(f\\a s ) = - S(Xp s + (1 - X)a s ) - ATr(/9 5 log <r s ) - (1 - A) Tr(cr 5 log a s ) 

= - XS(p s ) - (1 - X)S(a s ) - a - X Tr(p 5 log a s ) - (1 - A) Tr^ 5 log a s ) 

=XD(p s \\a s ) + (1 - X)D(a s \\a s ) - a 

=XD(p s \\a s )-a. 

Thus for our given vector v [the vector made from the relative entropies D(p s \\a )], we have 
found a w [the vector of the relative entropies D^Wa 15 )] such that for all 5 > (where H(e) < S), 

|| Av — w|| = a < 5 

for all A < e (where H{e) < 5). This completes the proof. □ 



III. THE LINDBLAD-UHLMANN CONE 

Define the convex cone A n c M> _1 : all vectors v satisfying the following inequalities, for all 

[n]DSD5'/l: 

vs > v s >, (5) 
v s > 0. (6) 

This defines the cone of all vectors that obey the only known inequality between relative entropies 
of subsystems, the Lindblad-Uhlmann monotonicity relation (which implies non-negativity). 
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Proposition 2 The extremal rays of K n are spanned by vectors u of the form 

fl ifSeXJ, 
us = s 

\0 *fSG*U, 

for a set family ^ U C and ^ U wz'zTj f/ze property that for all S G U and 5' D <S, S' £ U. (S«c?z 
a set family is called an up-setj 

Conversely, every up-set U, by the above assignment, defines a vector u G A n spanning an extremal 
ray. 

Proof Every extremal ray R of A n is spanned by a vector v G A n , such that R = M>o v. It has the 
property that if Aa + pb G R for A, p > and a, b G A n , then a, b G R. With this every point in 
the cone is a positive linear combination of elements from extremal rays. In geometric terms, R is 
an edge of the cone A n [6]. It is a standard result from convex geometry (see [6]) that an extremal 
ray is specified by requiring that sufficiently many of the defining inequalities are satisfied with 
equality in the sense that the solution space of these equations is one-dimensional. (Of course, in 
addition the remaining inequalities must hold.) 

In the present case, there are only two, very simple, types of inequalities. For a spanning 
vector v of an extremal ray R, the equations (i.e., inequalities satisfied with equality) take one of 
the following two forms: for A C B, C C [n], 

VA = VB, (7) 
v c = 0. (8) 

How can it be that v is specified by a set of such equations up to a scalar multiple? Since 
the equations only demand that an entry of v is or that two entries are equal, it must be such 
that there exists a subset U c 2^ such that for all A,B G U, the corresponding entries of v are 
equal, = vq = v, while for C G" U, it holds that vq = 0. Now, to satisfy all the monotonicity 
inequalities, U must be an up-set. (We note that v / to span a ray, hence v ^ 0.) 

Thus, v = du for the vector u constructed from the up-set U in the statement of the Proposition. 
This shows that every extremal ray is determined by an up-set. 

For the other direction, we first observe that u constructed from an arbitrary up-set U as stated 
satisfies all the inequalities. Furthermore, it is clear that many inequalities will be saturated. To 
show that R = M>o u is extremal, we only need to find a set of 2 n — 2 linearly independent 
equations of the form Q and © that are satisfied. This is given by 

va = V[ n ] for [n] ^ A G U, 
v B = for B <jt U. 

Indeed, these equations leave only the freedom to choose vr n u and then all entries of v are deter- 
mined. This concludes the proof that every up-set determines an extremal ray. □ 

Example 3 The following table shows all the extremal rays and hence all possible up-setsfor three parties 
up to permutations of parties. 
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FIG. 1: All possible 'up-sets' for three parties, up to permutations. Broken arrows indicate which sets have 
the corresponding element as a subset, i.e broken arrow implies is subset of. Every element that is inside a 
box or circle is defined as having relative entropy 1. A box indicates that we have chosen the set to have 
relative entropy 1, where as a circle indicates the set is forced to have relative entropy 1 as one of its subsets 
also has relative entropy 1. This 'forcing' of relative entropy via one of the subsets is represented as a black 
arrow. 
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Ray 8 
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These up-sets are also represented in graphical form in Fig. 1. 

Note that every extremal ray of the relative entropy cone is very well structured and can be 
defined precisely with up-sets. The standard entropy cone however shows no such structure 
and its extremal rays, although realised by highly structured states, show far less structure in the 
actually entropy values of the extremal rays (see |10, 14]). 



IV. A* = A n 

Clearly A* C A n since all actual states obey the Lindblad-Uhlmann monotonicity inequali- 
ties © and @. Since A n is closed, we thus get A* c A n . 

In this section we will show the opposite inclusion, A* D A n , thus showing equality between 
the relative entropy cone and the Lindblad-Uhlmann cone. 
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To show this, it will clearly be enough to show that on every extremal ray of A n there exists 
a nonzero vector contained in A* . In other words, if we can construct a pair of states that has a 
relative entropy vector on an extremal ray, for all possible extremal rays of A n , then due to approx- 
imate dilutability we can find entropy vectors along all points of all extremal rays. Since every 
point inside a cone can be made with a positive linear combination of points from its extremal 
rays, we obtain that every point inside the cone can be realised and A n = A* . 

Achieving these states can be identified with classical secret sharing schemes (see for exam- 
ple 1 16]) as we will explain. The formalism for a secret sharing scheme can be defined as follows. 
Imagine a defined secret bit that we want to share between a number of participants. We want 
only certain so-called "authorised" groups of participants to be able to recover the secret exactly, 
while unauthorised groups of parties get no information about the secret. It is clear that with 
every authorised group S, any group S' D S will also be authorised. So, the authorised groups 
will form an up-set called an access structure. 

Definition 4 An n-party secret sharing scheme for a bit b with access structure ^ U C 2^, ^ U, 
consists of the following 

(i) Random variables Xi(b), X 2 (b), X 3 (b), . . . , X n (b), each one associated with a participant labelled 
1, . . . , n in the secret sharing scheme. Xi(b) takes values in a set Xi. 

(ii) For (SeU, denote X s (b) = (Xi(b) : i G S), the collection of shares accessible to the group S 

(iii) For each S G U, there is a function f s : X s := H ieS Xi -» {Ml sA - fs{X s (b)) = b. For 
S U however, X s (0) and X s (1) have the same distributions. 

With this scheme the notion of an up-set is naturally included. Since an authorised group of 
parties are allowed to recover the secret, adding additional parties must also result in an autho- 
rised group since the decoding function can be chosen only to act on the previous authorised 
group. This is the defining feature of an up-set. To relate this to a quantum information setting, 
we can construct the following density matrix based on a secret sharing scheme: 

p{b)= =*!,..., =x n }\ Xl ){h® \()\x 2 2 ®---® \x n y}n. (9) 

The superscript on the terms of the tensor product denote the label of the share. We denote a 
partial trace of the matrix as 

p(bf= Pr{X j (b)=x j ,Vj€S}®\x j ){x j \*. (10) 
Xj-.jes jes 

p(b) s has the following properties : 

• If S G U then the supporting subspace of p(0) s is orthogonal to that of p(l) s which allows 
the group S to determine the secret bit exactly: p(0) s _L p(l) s . 

• If S ^ U then p(0) s = p(l) s and no information about the secret can be achieved. 

With this density matrix we can construct the following matrices for use in relative entropy 

D(p\\a): 

p s = p(0) s , (11) 
* S = l(p(0) S +p(l) S ). (12) 
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Note that if S U then p s = <j s and the relative entropy is zero. For S G U, we can calculate the 
relative entropy as follows: 



D{p s \\a s ) = Tr 
Using p(0) s _L p(l) s . 



p(0) s logp(0) s -p(0) s lo ? 



P(0) 5 , P(l) 



+ 



(13) 



Duller 5 ) = Tr 



p(0f lo g/ 9(0f - p(0f log ^f - + p(0f lo. 



(14) 



Since there are no elements in p(0) s that are present in p(l) s the third term is zero. Hence ex- 
panding the second term 



D(p s \\a s ) = Tr 



p(0) s log ^(O) 5 - p(0) s log p(0) s + p(0f (log 2)1 



(log2)Tr[ / 9(0) 5 ] = l. 



(15) 
(16) 



Note that the relative entropy is constant and independent of the number of elements of S. 
Hence we have states from which we can produce relative entropies in the form of up-sets de- 
scribed in Proposition 2 by simply realising a classical secret sharing scheme with the required 
access structure. There exists a secret sharing scheme for every up-set structure, in fact for every 
access structure Therefore for each extremal ray of A n there is a secret sharing scheme 

whose density operators according to eqs. ®, lITTIl and fj"2l will produce the required relative 
entropy vector and hence prove that each extremal ray is realisable. Hence we have proved that 
A* = A n and thus that monotonicity under restrictions is the only inequality satisfied by relative 
entropies. 

V. SIMPLE SECRET SHARING: THRESHOLD SCHEMES 



In this section we will describe a simple secret sharing scheme for a specialised access structure 
known as a threshold scheme. We will then build upon this scheme showing how we can construct 
schemes for any access structure. The threshold scheme was discovered by Shamir 1 15] and allows 
parties to recover a secret if and only if enough of the parties collaborate, such that their number 
is beyond a predetermined threshold number of parties. Each party is given a part of the secret 
which we call a 'share' of the secret. There is a total of n shares, one share for each party. A 
threshold value k is also determined such that if a number of parties get together and pool their 
shares, if the number of shares they have are greater than or equal to k then they can recover 
the secret precisely. However, if the number of shares is less than k, then no information can 
be extracted about the secret. Accordingly, these schemed are called (n, fc)-threshold schemes, 
depending on the number of parties and the desired threshold value. The construction of the 
threshold scheme is outlined as follows. The premise for the scheme is based on evaluations of a 
polynomial. Imagine the following polynomial. 



y = a + aix + a 2 x 2 + a 3 x 3 + . . . + a r 



-ix 



(17) 



We label ao as the secret value and the shares as evaluations of this polynomial at different points. 
Geometry tells us that we need exactly m evaluations of this polynomial to determine the coef- 
ficient ao and that if we have any fewer than m evaluations any value of ao would fit the given 
points. This means that if we have m or more evaluations we know the secret exactly and if we 
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have fewer than m evaluations we know nothing about the secret. The evaluations of the polyno- 
mials becomes the 'shares' of the scheme and we perform (n, A;) -threshold scheme the calculations 
over a finite field. Here is a formulation of the scheme extracted from the original paper by Shamir 
d. 

• Choose a random k — 1 degree polynomial y(x) = ao + a\x + a,2X 2 + . . . + a^-ix*^ 1 and let 
s be the secret where s = ao i.e. ai, . . . a^-i are chosen independently and uniformly from 
the field GF(p) of p elements (integer modulo p) 

• The shares are defined as D\ = y(l), D2 = 2/(2), . . . , A = y(i), ... ,D n = y(n). 

• Any given subset of k of these Di values together with their indices can find the coefficients 
of y(x) by interpolation and hence find the value of s = y(0). 

• Knowing k — 1 or fewer shares will not reveal what the value of s as there exists polynomials 
that will fit the given points in the polynomial and allow ao = or ao = 1 with every 
polynomial equally likely. 

• We use a set of integers modulo a prime number p which forms a finite field allowing 
interpolation. 

• Given that the secret is an integer we require p to be larger than both max s and n. 

• If we only have k — 1 shares, there is one and only one polynomial that can be constructed 
for each value of s in GF(p). Since each polynomial is equally likely by construction, no 
information about the secret can be gained. 

This scheme can be easily translated to the quantum density matrix defined in eq. ©. Most 
of the probabilities in the sum are zero except for the ones that are valid for a polynomial fitting 
the secret value, with shares labeling that part of the sum. This scheme has a very specific access 
structure, but we can expand to more general access structures. Consider the number of parties 
p, we can have n > p so that we have more shares than parties, allowing us to distribute multiple 
shares to single parties. This allows us to have access structures not possible with the simple 
access structure. Imagine that we require an access structure given in Fig. 2. We require that B 
and C cannot recover the secret, however if they pool their resources together they can. We also 
need A to be able to recover the secret independently. Under the normal threshold scheme, we 
need the threshold to be set at k = 1 so that single party A can recover the secret. However, 
this means B and C will independently be also able to recover the secret so we cannot create the 
required access structure. 

However, if we use a scheme with more shares than parties, we can achieve this access struc- 
ture, see Example 5. Many up-sets can be realised using this modified threshold scheme. The 
following example provides the required threshold scheme and the resulting density matrices. 

Example 5 Imagine an n = 3 system, each labelled by A,B and C respectively. Consider also the following 
up-set representing an extremal ray. This is Ray 6 as used in the previous section. 



VA 


V B 


v c 


VAB 


VAC 


VBC 


VABC 


1 








1 


1 


1 


1 



With this up-set we can now construct a secret sharing scheme to represent it. One of the easiest construc- 
tions to understand is the threshold scheme. The scheme required is a (4,2) threshold scheme: 4 is the total 
number of shares, 2 shares or higher required to construct secret. We distribute the shares as follows: two 
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FIG. 2: Diagram of up-set used in Example 5 

shares to A and only one share to B and one to C. This leads us to the required access structure as shown 
below. 
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AB 


AC 


BC 
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Shares 
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Above threshold 
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/ 



Since we have a total of four shares, we have to construct the scheme of a finite field of 5. In this example 
calculations will be assumed to be done over this finite field. Since the threshold is two shares, we only need 
consider polynomials of order one, since only two or more values are necessary to recover the polynomial of 
order 1. Therefore the possible polynomials are as follows. 



y 
y 
y 
y 
y 



s 

S + X 

s + 2x 
s + 3x 
s + 4x 



We can now embed this scheme into a quantum system. Each system has the same number ofqudits as the 
corresponding party has shares, with d being large enough to incorporate the finite field values (i.e. in this 
case d=5). For example system A has two qudits whereas system B only has one. We now construct the 
density matrices p(0) and p(l) as follows: 

p(0) = i(|0000)(0000| + |1234}(1234| + |2413)(2413| + |3142}(3142| + |4321}(4321|) (18) 

^(1) = -(|1111)(11H| + |2340}(2340| + |3024)(3024| + |4203}(4203| + |0432}(0432|) (19) 

A has the first two qudits, B the third and C the fourth. From this we can construct the overall system 
described previously. We take p = p(0) and a = gi2l±gW as j n e q S , (Effl i and dl2t . As examples we may 
compute 



PA = i(|00><00| + |12)(12| + |24)(24| + |31)(31| + |43)(43|), 

OA = ^(|00)(00| + |12)(12| + |24)(24| + |31)(31| + |43)(43| 
+ |11)(11| + |23)(23| + |30)(30| + |42)(42| + |04)(04|). 



(20) 



(21) 
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FIG. 3: Diagram of up-set used in Example 6 



Therefore it can be verified that the relative entropy of party A is log 2. Repeating this for party B. 

PB = |(I0><0| + |3)(3| + |1)(1| + |4)(4| + |2)(2|) = a B . (22) 

Therefore the relative entropy for B is 0. All other relative entropies can be verified in this way. 

Thus giving unequal number of shares to the parties can achieve more complicated access struc- 
tures. However not all access structures can be produced in this way. For example imagine that 
we have a 4 parties A,B,C and D with number of shares in each party being a,b,c and d respec- 
tively. We require that A and B can recover the secret and that C and D can recover the secret 
but no other two party combination. If A and B can recover the secret then their combine total of 
shares must be greater than k i.e. a + b > k. Therefore either a > \ or b > \. Similarly we can 
claim that c > | or d > |. Say that in this case a > |,c > |. Hence there exists another two party 
combination, A and C, that have a number of shares greater than k and can recover the secret i.e. 
a + c > k. Therefore the access structure is impossible to produce with this scheme. However 
there are general methods for dealing with arbitrary access structures These allow us to 

represent any extremal ray. One strategy is to create a hierarchy of threshold schemes. Here we 
illustrate the strategy with an example. 

Example 6 Imagine an n = 4 system which we label A,B,C and D respectively. Consider also the 
following up-set representing an extremal ray. 



VA 


VB 


V C 


VD 


VAB 


VAC 


VAD 


VBC 


VBD 


VCD 


VABC 


VABD 


VACD 


vbcd 


VABCD 














1 














1 


1 


1 


1 


1 


1 



Note that access structure representing this ray requires that no single party has access to the secret and 
only parties A and B collaborating, and C and D collaborating will be authorised. Also any greater number 
of parties will always contain an authorised group and are therefore also authorised. The required access 
structure can be represented by two schemes. This in illustrated in Fig. 3. Each scheme requires a (2, 2)- 
threshold scheme, 2 total number of shares with a threshold for recovering the secret of 2 shares. We 
distribute the shares as follows : in one scheme (scheme a) we give 1 share to A and 1 share to B. In the 
other scheme (scheme f3) we give 1 share to C and 1 share to D. This ensures that the secret can be recovered 
by authorised parties via at least one of the schemes reaching threshold, shown below. 
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A 


B 


C 


D 


AB 


AC 


AD 


BC 


BD 


CD 


ABC 


ABD 


ACD 


BCD 


ABCD 


Shares(scheme a) 


1 


1 








2 


1 


1 


1 


1 





2 


2 


1 


1 


2 


Shares( scheme f3) 








1 


1 





1 


1 


1 


1 


2 


1 


1 


2 


2 


2 


Above threshold 


X 


X 


X 


X 


/a 


X 


X 


X 


X 




/a 


/a 


Sp 


Sp 





Since we have a total of two shares for each scheme, we construct the scheme using a finite field of '3 elements. 
From now on calculations will be assumed to be done over this finite field. Since the threshold is two shares, 
we only need consider polynomials of order one, since only two or more coordinates are necessary to recover 
the polynomial of order 1. Therefore the possible polynomials are as follows. 

y = s 
y = s + x 
y = s + 2x 

In the construction of the quantum density matrix we need to consider all possible set of shares the individ- 
ual parties can have. The possible combinations are presented in the following tables. 



Scheme a 


Scheme (3 


ABCD 




Scheme a 


Scheme (3 


ABCD 


y = s 


y = s 


0* 0* *0 *0 




y = s 


y = s 


1* 1* *1 *1 


y = s 


y = s + x 


0* 0* *1 *2 




y = s 


y = s + x 


1* 1* *2 *0 


y = s 


y = s + 2x 


0* 0* *2 *1 




y = s 


y = s + 2x 


1* 1* *0 *2 


y = s + x 


y = s 


1* 2* *0 *0 




y = s + x 


y = s 


2* 0* *1 *1 


y = s + x 


y = s + x 


1* 2* *1 *2 




y = s + x 


y = s + x 


2* 0* *2 *0 


y = s + x 


y = s + 2x 


1* 2* *2 *1 




y = s + x 


y = s + 2x 


2* 0* *0 *2 


y = s + 2x 


y = s 


2* 1* *0 *0 




y = s + 2x 


y = s 


0* 2* *1 *1 


y = s + 2x 


y = s + x 


2* 1* *1 *2 




y = s + 2x 


y = s + x 


0* 2* *2 *0 


y = s + 2x 


y = s + 2x 


2* 1* *2 *1 




y = s + 2x 


y = s + 2x 


0* 2* *0 *2 



TABLE I: All possible shares for s = TABLE II: All possible shares for s = 1 



Each party has two registers, one for each scheme. If a party has no share then the register associated 
with that scheme is put into a fixed state (here \*)a, \*)b, \*)c, \*)d) which is uncorrelated to the variables 
for that scheme. Thus the density matrix p(0) is 

p(0) = -( |0*)(0*U |0*)(0*|b |*0}(*0|c |*0}(*0|d + |0*)(0*U |0*}(0*|b |*2)<*2|d 

+ |0*}(0*U |0*}(0*|b |*2)(*2| c |*1>(*1|d + |1*}(1*U |2*)(2*|b |*0}(*0| c |*0}(*0|d 
+ |2*}(2*[ B I *1>(*1 |c |*2)(*2| d + |1*)(1*|a |2*)(2*| B |*2}(*2|c< 

+ |2*)(2*U |1*}(1*|b |*0)(*0| c |*0)(*0|d + |2*)(2*U |1*}(1*|b |*l)(*l|c |*2}(*2|b 

+ \2*){2*\ A |1*}(1*|b |*2)(*2| c |*1}(*1| d ). 
Similarly we can construct p(l) by repeating the process but setting the secret bit to be 1, i.e. 
|1*)a|1*)b|*1)c|*1)d etc-, leading to the density matrix p(l): 

piX) = g( |1*){1*U |*1)(*1|d + |1*}(1*U |l*)(l*|s |*2)(*2| c |*0>(*0| D 

+ |1*)(1*U |1*}(1*|b |*0)(*0| c |*2)(*2| d + |2*)(2*U |0*)(0*|b |*1}(*1|c 
+ |2*}(2*U |0*}(0*[b |*2)(*2|c |*0)(*0| d + |2*)(2*U |0*)(0*|b |*0}(*0| c |*2}(*2|b 
+ |0*}(0*U |2*}(2*[b |*1)(*1|d + |0*X°*U l 2 *)( 2 *b |*2)(*2[ c 1*0}(*0|b 

+ |0*}(0*U |2*)(2*|b |*0)(*0| c |*2)(*2| d ). 
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We notice that in both states p(0) and p(l) in this example the state \*)a\*)b\*)c\*)d factors out so 
that we could equally well take 

p(0) = i(|0000)(0000| + |0012)(0012| + |0021}(0021| + [1200)(1200| 
9 

+ |1212)(1212| + |1221>(1221| + |2100)(2100| + |2112)(2112| + |2121)(2121|) , (23) 

p(l) = -(|1111)(1111| + [1120)(1120| + |1102)(1102| + |2011)(2011| 
9 

+ |2020)(2020| + |2002)(2002| + |0211)(0211| + |0220)(0220j + |0202}(0202|) . (24) 

[Note however that in more complicated examples parties need shares from more than one scheme.] From 
this we can construct the overall system described previously, and for example for parties AB. 

PAB = |( 00><00| + |12)(12| + |21)(21|), (25) 
cab = i( 00)<00| + |12)(12| + |21)(21[ + |11)(11| + |20)(20| + |02)(02|). (26) 
Therefore it can be verified that the relative entropy of parties AB is log 2. Repeating this for parties BC, 

Pbc = i(|ll)(ll| + |12)(12| + |10Xl0| + |02>(02| + |00)(00| + |21>(21| + |22>(22| + |20)(20|) = a BC - (27) 

Therefore the relative entropy for BC is 0. All other relative entropies can be verified in this way. 

The idea of using a hierarchy of threshold schemes was discovered by Ito, Saito and Nishizeki 
0] and requires an exponential number of threshold schemes to represent an access structure. 
This number of schemes required is irrelevant as long as a scheme exists and we can create the 
corresponding density matrix. A simpler general access structure was found by Benaloh and 
Leichter |1], which does not use threshold schemes but can be directly translated to the required 
density matrices in eq. ©. 

VI. CONCLUSION 

In this paper, we have determined the set of all relative entropy vectors for general states 
on (general) n-party systems: it coincides with the convex cone defined by non-negativity and 
monotonicity of the relative entropy. We have done this by first showing that the former set in is 
indeed a convex cone, and then demonstrating that every extremal ray in the latter cone is realised 
by a specific pair of states. These extremal rays are characterised by up-sets in 2™, and the pairs 
of states correspond to (classical) secret sharing schemes. 

A particular consequence is that the cone of relative entropy vectors is the same for quantum 
states and for classical probability distributions. This is in marked contrast to the case of entropy 
vectors, where even for n = 2 classical and quantum entropy cone differ 1 14]. 

Beyond the characterisation in terms of convex geometry, our result also means that, apart 
from monotonicity, there can be no other univeral relation between the relative entropy values of 
the reduced states in a composite systems (except that is follows trivially from monotonicty). In 
this sense, quantum and classical relative entropy is completely characterised by the monotonicity 
relation. 

We are now in a position to go back to our assumption of finite dimensional systems and the 
demand that all relative entropies are finite. Clearly, if some of the parties are described by infinite 
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dimensional quantum systems, we still have monotonicity 1 17], so the relative entropy vectors are 
all within the Lindblad-Uhlmann cone. In this case, and even in the finite dimensional case some 
entries in a relative entropy vector may be positive infinity. However, even this does not present a 
problem, once we realise that the groups where the value is infinite form an up-set, so the vector 
can indeed be obtained as a limit of finite relative entropy vectors in the Lindblad-Uhlmann cone. 

Another mathematical peculiarity is the following: From the proof of achievability of all ex- 
tremal ray of the Lindblad-Uhlmann cone, we discover that every point in the entropy cone is 
achievable rather than infinitely approximated, i.e. A n = A*. This is due to the fact that every 
point on all exremal rays can be attained. To see, this, simply choose p(0) and p(l) in eq. fl2l with 
different weights p and 1 — p (0 < p < 1). Then the calculation following that equation shows 
that the relative entropy is either H2 (p) or depending on whether S is an authorised set or not. 
By additivity in Lemma ^ we obtain that every point on the extremal rays is realised, hence every 
point in the Lindblad-Uhlmann cone. 

We conclude the paper by commenting briefly on possible connections of our result to the en- 
tropy cone, and possibly to the relative entropy of entanglement. In the above arguments we have 
often used the formula D(p\\a) = —S(p) — Tr plog a, which means that if we make the restriction 
a = \H, the maximally mixed state in d dimensions, the relative entropies (now dependent only 
on p) evaluate to log d — S(p). Going through the proof of Lemma[l]we see that for any number n 
of parties, the set of all these relative entropy vectors is also a convex cone, and one might think 
that its relations would capture all inequalities for the entropy. That this is too optimistic a hope, 
is indicated by the fact that the relative entropy is expressed by the entropy and a term beyond 
what can be expressed by general entropies alone (essentially the log of the rank). And it is indeed 
not the case, since for example the nonegativity of the relative entropy translates into S(p) < log d. 
However, the fundamental fact that the entropy S(p) is nonnegative, is not captured at all, since 
that would require an upper bound on the relative entropy depending on the dimension. Still, 
there may be some less stringent relation between the entropy and the relative entropy cones, 
whose existence we would like to advertise as an open problem. 
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